API safeties

Increase security and sanity checks to allow for new features.

- ability to exchange signed information with gitlab-rails via a shared secret
- content-type checks to prevent leaking internal API data

Signed messages are implemented using JWT. To make this possible we vendor the jwt-go library.

Companion MR in gitlab-rails: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/5907

See merge request !60

Fix backend URL parsing

Our fancy custom flag parser broke in Go 1.7. Also, the new 'strict
TCP connection' feature was not handling backend hosts like
`localhost:3000` (it was panicking).

Fixes:

https://gitlab.com/gitlab-org/gitlab-workhorse/issues/54
https://gitlab.com/gitlab-org/gitlab-workhorse/issues/53

See merge request !61

From https://github.com/dgrijalva/jwt-go . This library is MIT
licensed just like gitlab-workhorse itself.

Fix typo in header name



See merge request !59

Strict roundtripper

Workhorse usually connects to Rails over a Unix socket. This makes it
impossible to accidentally follow redirects to another host. This
change applies the same strictness when connecting to Rails over TCP.


See merge request !56

Make "go test" work without path helper



See merge request !57

Workhorse usually connects to Rails over a Unix socket. This makes it
impossible to accidentally follow redirects to another host. This
change applies the same strictness when connecting to Rails over TCP.

Improve support for standard Go tools



See merge request !55